The Paycheck Protection Program (PPP) distributed hundreds of billions of dollars to businesses during the COVID-19 pandemic. While the program helped many organizations continue operating during an economic crisis, it also became the focus of large-scale federal fraud investigations.
Years after PPP lending ended, federal agencies are still investigating alleged misuse of funds, false certifications, identity theft schemes, and fraudulent loan applications. Both borrowers and lenders may still receive audit requests, subpoenas, or document inquiries connected to PPP loans.
Because of ongoing enforcement efforts and expanded statutes of limitations, maintaining complete and organized PPP loan documentation remains critically important.
This guide explains what triggers PPP loan investigations, what qualifies as PPP fraud, how audits work, how updated retention rules affect both borrowers and lenders, and how organizations can improve PPP document management practices.
Paycheck Protection Program (PPP) Overview
The Paycheck Protection Program was created under the CARES Act in 2020 to help businesses maintain payroll and continue operations during the COVID-19 pandemic. The Small Business Administration (SBA) administered the program through participating lenders, including banks, credit unions, fintech lenders, and approved non-bank institutions.
PPP funds were intended for approved business expenses such as:
- payroll costs
- employee benefits
- rent and lease payments
- utilities
- mortgage interest
- certain operational expenses
Many borrowers later applied for PPP loan forgiveness after documenting how the funds were used. While many organizations used PPP funds appropriately, federal investigators later uncovered widespread fraud schemes involving fake businesses, inflated payroll claims, identity theft, and misuse of loan proceeds.
How PPP Oversight Applies to Borrowers and Lenders
PPP investigations can affect both borrowers and lenders, although the risks are different for each group.
Borrower Responsibilities
Borrowers were responsible for:
- accurately reporting payroll information
- certifying eligibility
- using funds appropriately
- maintaining supporting documentation
- complying with forgiveness requirements
Businesses that cannot support their certifications or use-of-funds claims may face additional scrutiny during reviews or investigations.
Lender Responsibilities
PPP lenders were responsible for:
- collecting borrower certifications
- reviewing payroll documentation
- following Bank Secrecy Act requirements
- processing forgiveness applications
- maintaining loan records
Although lenders were generally allowed to rely on borrower certifications under SBA guidance, institutions may still receive requests tied to audits or investigations.
What Triggers a PPP Loan Investigation?
Not every audit or document request means fraud occurred. However, certain patterns and inconsistencies may increase the likelihood of additional review. Common triggers include inconsistent payroll records, unusually large loan amounts, duplicate PPP applications, inaccurate employee counts, conflicting tax documentation, suspicious banking activity, rapid transfers of loan proceeds, complaints or whistleblower reports, identity theft indicators, and falsified business information.
Federal agencies also use automated analytics and cross-agency data matching to identify anomalies connected to PPP loans.
What Is Considered PPP Loan Misuse?
PPP fraud generally involves knowingly providing false information or using loan proceeds for unauthorized purposes.
Examples of Proper PPP Fund Usage
| Approved Uses | Examples |
| Payroll expenses | Employee wages, payroll taxes, benefits |
| Business occupancy costs | Rent, lease payments, mortgage interest |
| Utilities | Electricity, internet, water |
| Operational expenses | Certain approved software and supplier costs |
Examples of Potential PPP Misuse
| Misuse Examples | Why It May Trigger Investigation |
| Inflating payroll numbers | May increase loan amount improperly |
| Creating fake employees | False eligibility certifications |
| Using funds for personal luxury purchases | Unauthorized use of loan proceeds |
| Submitting multiple applications for the same business | Potential duplicate fraud |
| Using stolen identities or shell companies | Possible criminal fraud |
| Altering payroll or tax documents | False supporting documentation |
Federal prosecutors have pursued PPP fraud cases involving fake businesses, forged tax forms, identity theft, organized fraud rings, and misuse of forgiven loan funds.
Is the SBA Still Auditing PPP Loans?
Yes, the SBA and other federal agencies are still auditing and investigating PPP loans. Reviews may occur before forgiveness approval, after forgiveness approval, during broader fraud investigations, and through random or risk-based audits. Smaller loans are generally considered lower risk, but they are not automatically exempt from review. Investigations may still occur if agencies identify suspicious activity or inconsistencies.
How Do I Know if My PPP Loan Is Being Investigated?
Organizations may become aware of investigations through SBA document requests, lender inquiries, subpoenas, law enforcement contact, audit notices, and requests for additional forgiveness documentation. In some cases, businesses may first learn about an issue when forgiveness is delayed, investigators request payroll records, or financial institutions flag suspicious activity.
Receiving a request for documentation does not necessarily mean fraud occurred. Many reviews are part of broader oversight and compliance procedures.
Can PPP Loans Be Forgiven During an Investigation?
In some situations, forgiveness reviews may pause while investigations are ongoing. The SBA or lenders may delay forgiveness determinations if eligibility concerns exist, records are incomplete, fraud allegations are unresolved, or investigations remain active. Forgiveness outcomes depend heavily on documentation quality, compliance history, accuracy of certifications, and responsiveness to requests.
Organizations with organized records are often better positioned to respond efficiently during reviews.
Updated PPP Record Retention Requirements
PPP record retention requirements remain important because investigations and audits may continue years after loans were issued. Originally, many borrowers and lenders focused on six-year retention periods tied to forgiveness or repayment. However, federal enforcement changes expanded the timeline significantly.
Congress extended the statute of limitations for certain COVID-19-related fraud offenses to 10 years. This means PPP documentation may remain relevant much longer than organizations initially expected.
How Long Should PPP Records Be Retained?
Many legal and compliance professionals now recommend retaining PPP records for at least 10 years.
Important records may include:
- PPP borrower applications
- payroll reports
- tax filings
- bank statements
- forgiveness applications
- lender communications
- underwriting records
- employee compensation documentation
Both lenders and borrowers should evaluate legal hold requirements, state retention laws, internal compliance policies, and audit readiness considerations.
How to Maintain Compliant PPP Loan Documents
Many organizations handled PPP documentation quickly during the pandemic using email attachments, paper records, spreadsheets, payroll portals, and other types of temporary storage systems. Years later, these fragmented systems can create challenges during audits or investigations. Many businesses and lenders are now improving records management practices to support long-term compliance via:
- Digitize PPP Documentation: Digitizing records can help organizations improve retrieval speed, support remote access, simplify audits, reduce physical storage, and improve disaster recovery readiness.
- Use Secure Cloud Storage and Document Management Systems: Secure cloud storage and document management systems can improve access controls, document organization, audit trails, backup management, and long-term retention workflows.
- Maintain Secure Physical Storage: Some organizations still retain original paper loan records and supporting financial documentation. Secure offsite storage can help protect records from unauthorized access, environmental damage, accidental destruction, and operational disruptions.
How Record Nations Can Help
PPP audits, investigations, and retention requirements have created long-term records management challenges for both lenders and borrowers.
Record Nations helps organizations connect with secure records management providers nationwide for:
- document scanning
- secure document storage
- cloud storage
- records digitization
- document management systems
- backup storage solutions
Our network providers can help organizations improve records accessibility, support compliance initiatives, and maintain secure long-term storage for sensitive financial and employment documentation.
Whether your organization needs help digitizing PPP loan files or implementing secure offsite storage for long-term retention, Record Nations can help connect you with providers that fit your operational and compliance needs.
To get started, request free quotes today or call (866) 385-3706.
